FIDO FIDO Credential Lifecycle & Key Management 1 — Questions and Answers
Question 1: In FIDO2, what type of cryptographic key pair is generated during the registration ceremony?
- A symmetric AES-256 key shared between authenticator and RP
- An asymmetric key pair where the private key never leaves the authenticator (Correct answer)
- A Diffie-Hellman ephemeral key pair used only for that session
- A pre-shared key derived from the user's password via PBKDF2
Correct answer: An asymmetric key pair where the private key never leaves the authenticator
FIDO2 registration generates an asymmetric key pair; the private key is generated and stored securely inside the authenticator and never exported.
Question 2: What is a 'resident credential' (discoverable credential) in FIDO2, and how does it differ from a non-resident credential?
- A credential stored in the cloud that can be discovered by any FIDO server
- A credential stored directly on the authenticator, enabling usernameless login without a credential ID hint (Correct answer)
- A credential issued by the FIDO Alliance that is pre-installed on certified devices
- A credential that requires an internet connection to validate against an online key store
Correct answer: A credential stored directly on the authenticator, enabling usernameless login without a credential ID hint
Resident credentials are stored on the authenticator itself, allowing the user to authenticate without providing a username or credential ID hint (passwordless flow).
Question 3: How does a FIDO2 authenticator protect the private key from extraction in a software-based (platform) authenticator?
- By encrypting it with the user's password before storage
- By storing it in a hardware-backed secure enclave such as TPM or Secure Enclave (Correct answer)
- By splitting the key into shares distributed across multiple cloud services
- By using a one-time-use key that is regenerated on every authentication
Correct answer: By storing it in a hardware-backed secure enclave such as TPM or Secure Enclave
Platform authenticators use hardware-backed secure storage (TPM on Windows, Secure Enclave on Apple devices) to protect private keys from OS-level extraction.
Question 4: What happens to a FIDO2 private key when a user deletes a passkey from their device?
- It is archived in the FIDO Alliance key escrow service for recovery
- It is permanently destroyed on the authenticator and the corresponding public key on the RP becomes unusable (Correct answer)
- It is transferred to a backup authenticator if one was previously registered
- It is encrypted and stored in the user's cloud account for future restoration
Correct answer: It is permanently destroyed on the authenticator and the corresponding public key on the RP becomes unusable
Deleting a passkey destroys the private key on the authenticator; the RP's stored public key is now an orphaned, non-functional credential.
Question 5: Which FIDO2 concept describes credentials that are synchronized across a user's devices via a cloud account (e.g., iCloud Keychain, Google Password Manager)?
- Roaming authenticator credentials
- Synced passkeys (Correct answer)
- Cross-origin credential delegation
- Federated FIDO tokens
Correct answer: Synced passkeys
Synced passkeys are discoverable credentials backed up and synchronized across devices through a platform's cloud keychain, enabling multi-device passkey access.
Question 6: What security consideration arises specifically from synced passkeys that does not apply to hardware-bound (device-bound) passkeys?
- Synced passkeys cannot perform user verification
- The private key material travels across a network, so cloud account security becomes part of the threat model (Correct answer)
- Synced passkeys do not support the ES256 algorithm
- Only enterprise-managed devices can use synced passkeys
Correct answer: The private key material travels across a network, so cloud account security becomes part of the threat model
Because synced passkeys replicate private key material through cloud infrastructure, compromise of the user's cloud account could expose passkey material.
FIDO FIDO Credential Lifecycle & Key Management 1
In FIDO2, what type of cryptographic key pair is generated during the registration ceremony?